Payment Institution License in Spain

The payment institution license is the authorization to provide certain payment services on a professional basis within the regulatory framework that applies in Spain. It is not a banking license or an EMI license: it has its own regulatory perimeter.

The key is not just obtaining the license, but being able to run an institution that can be supervised from day one: controls in operation, funds safeguarded and compliance that is actually alive.

When the model enters the chain of payment execution, order handling or operations with client funds, and can no longer be presented as a purely technological or ancillary activity.

The usual mistake is to assume that having a software layer means there is no regulated activity. That misunderstanding tends to break the project when partners, product and investment are already committed.

Each license type has a different regulatory perimeter and its own requirements depending on the service you want to provide:

• A payment institution (PI) provides payment services without issuing electronic money.
• An electronic money institution (EMI) can also issue electronic money (wallets, prepaid cards, stored balances).
• A bank can take deposits from the public, which greatly widens its perimeter and its capital and supervisory requirements.

Choosing the wrong license type from the outset delays the whole process and may force you to restructure your business model.

It reviews whether the application file is consistent, complete and defensible: programme of operations, corporate structure, directors, key functions, internal policies, control system, third parties, technology and real capacity to operate.

The supervisor checks whether the business described can be sustained by people, processes, contracts, controls and evidence that make sense together. Document consistency matters as much as the legal content.

Safeguarding of funds and the AML/CFT framework are two central pieces of a payment institution, not secondary annexes. They affect the quality of the application, the relationship with banking partners and the future strength of the institution.

They force you to set out in practice the flow of funds, reconciliations, onboarding, monitoring, reporting, internal roles and evidence. When they are improvised, the supervisor spots it quickly.

The statutory deadline for a decision is 3 months from the filing of the complete application, although in practice the process can stretch to 6-12 months depending on the complexity of the model and the quality of the application file.

What usually makes a license more expensive and slower is not drafting it, but fixing it: redoing annexes, clarifying contradictions, answering information requests or redesigning parts of the business that had not been properly closed.

As a general rule, no. Providing payment services without prior authorization is a very serious infringement.

There are some limited exceptions (an exemption regime for very small volumes, ancillary activities) that must be analyzed case by case. The usual alternative while your own license is being processed is to operate under the umbrella of an already authorized institution through an agent or regulated distribution agreement.

The most important phase begins: operating as a supervised institution with ongoing compliance, internal control, incident follow-up, third-party oversight, training and reporting.

• Maintaining AML/KYC controls and active monitoring.
• DORA compliance: ICT risk management, business continuity, incident reporting.
• Periodic reporting to the Bank of Spain and handling of information requests.
• Ongoing review of critical third parties, SLAs and outsourcing.
• Periodic audits and updating the framework as regulations change.

The license is not the end of the project: it is the starting point of supervised operations.

There is no single figure: the cost varies with the model, the range of services and the project's starting point. The factors that drive the cost are:

• Minimum capital: between €20,000 and €125,000 depending on the payment services to be provided (cash placement on an account, cash withdrawal, execution of payment transactions, issuing of payment instruments, money remittance or payment initiation).
• Legal and regulatory advice: regulatory fit, drafting the application file, internal policies and handling information requests from the Bank of Spain.
• Internal structure: key functions (compliance, AML, audit, risk), fitness and propriety of directors and, where appropriate, outsourcing of some functions.
• Technology and critical providers: agreements with banks for safeguarding, KYC/AML systems, monitoring, DORA framework.
• Ongoing compliance: periodic audits, training, reporting and regulatory updates (PSD3, AMLR).

What stretches out the process and drives up the cost is not drafting the application file, but fixing it: a regulatory fit that was poorly defined at the start costs months and extra rounds of information requests.

It depends on the actual flow of funds. If the platform:

• Receives payments from buyers and holds them before paying sellers → it probably does need a PI license (or must work with an authorized PI/EMI as an agent or partner).
• Uses a payment provider that separates the flows and never touches the money → it can operate without a license, but the contract and documentation must show this clearly.
• Runs "split payments" or pooled collections with later settlement → it almost always falls within the regulated perimeter.

The usual mistake is to assume that using Stripe, Adyen or another provider means you carry out no regulated activity of your own. The reality depends on the contractual and technical design of the flow, not on the tools you use.

Each option makes sense at a different stage:

• Agent of an authorized PI: fast time-to-market (weeks instead of months), lower initial cost, but dependence on the principal institution's policies, systems and rate card. Suitable for validating product-market fit or launching quickly.
• Your own license: a 6-12 month process and a larger initial investment, but full control over operations, European expansion through passporting, a better valuation from investors and more bargaining power with banks. It is a strategic asset.

Many projects start as an agent and, once the model is validated, apply for their own license. The transition must be planned well in advance, because changing the regulatory status affects clients, contracts and operations.

The PI license application file includes, among other documents:

• Programme of operations report: payment services to be provided, business model, clients, channels and projections.
• Corporate structure: deed of incorporation, paid-up capital, organization chart, identification of qualifying shareholders.
• Fitness and propriety of directors and key function holders: CVs, commercial and professional good repute, experience and availability.
• Internal policies: safeguarding, AML/CFT, internal control, risk management, conflicts of interest, market conduct.
• Technology and DORA framework: architecture, ICT risk management, business continuity, critical providers and resilience testing plan.
• Outsourcing: contracts, SLAs, controls and an exit plan for contingencies.
• Operating procedures: KYC/onboarding, monitoring, incident management, customer service and complaints.

The quality and consistency across these documents carries as much weight as the correctness of each one on its own.

As of July 2026, PSD3 and the PSR Regulation are still going through the EU legislative process and do not yet apply: your license is governed by PSD2 (Royal Decree-law 19/2018). Once adopted, the reform is expected to fold EMIs into the payment institution category, tighten anti-fraud controls (payee verification, SCA) and open a transitional re-authorization period for institutions that are already licensed.

In practice: don't wait for PSD3 to apply for your license — obtaining it now with a solid application file gives you an edge in the transition — but design your policies and technology with the new requirements in mind.